Member Avatar for jzuzphreek

I've scoured all the articles dealing with svchost.exe and couldn't find one that quite addressed my problem.

In task manager I have 6 instances of svchost.exe running. 3 instances are SYSTEM, 1 is LOCAL SERVICE, and 2 are NETWORK SERVICE. All but one of the Network Service instances run at 0% CPU Usage. The offending Network Service runs between 45-51% CPU Usage. Here's the catch, when I plug the laptop into the Network and it grabs an IP address, the usage drops (almost immediately) down to 0% usage.

My problem is that the laptop is almost never plugged into the network, it's the District Director's machine that she uses from home. I'm very apprehensive to stop the service because I don't know what effect that will have on the machine. What should I do? Has anyone seen a situation like this? I've run a virus scan that turned up nothing.

  • 1 Contributor
  • 2 Replies
  • 485 Views
  • 7 Hours Discussion Span
  • Latest Post Latest Post by jzuzphreek

Dani AI

Generated

Short practical troubleshooting notes tied to ’s observations (Network‑Service svchost rises while offline, drops immediately when the laptop gets an IP; killing the process is temporary):

  • First priority: identify which Windows service(s) are actually running inside that high‑CPU svchost instance. Two reliable ways are the Sysinternals Process Explorer GUI (shows services, threads and call stacks) and the built‑in tasklist command with the /svc switch. (en.wikipedia.org)

  • Map the service groupings back to Windows configuration so the service name becomes actionable. The Service Host groups are defined in the registry under the Svchost key; querying that key shows which services belong to which host grouping. (Useful when a host contains multiple services and you need the precise service name.) (learn.microsoft.com)

  • To troubleshoot without permanently changing system behavior, isolate a suspect service into its own host process so it can be tested independently (Microsoft’s perf team documents using SC CONFIG to change the service type to “own”, then revert to “share” when done). That lets you confirm whether a particular service is the CPU source. Example form:

    tasklist /svc
sc config <ServiceName> type= own
(restart the service)
sc config <ServiceName> type= share

    Follow the documented sc config guidance and restart as required. (learn.microsoft.com)

  • Common causes when behavior depends on network presence: network‑related services (Windows Update / BITS, DHCP/NLA, etc.) can spin or loop when offline or when an update client retries repeatedly — Windows Update and BITS are frequently reported culprits. Check Event Viewer for service errors and the Windows Update/BITS logs before disabling anything permanently. (technewstoday.com)

  • Advanced: if identification still fails, use Process Explorer to inspect the busy thread’s call stack (it will show the DLL/module doing the work). Always create a restore point before changing service startup types, don’t disable critical services (RPC, etc.), and verify svchost’s file path/signature before assuming malware. (en.wikipedia.org)

These steps convert the observed symptom (CPU up when offline, down when connected) into a deterministic diagnostic sequence: identify service → isolate to its own host → inspect logs and thread stacks → remediate (repair/patch/adjust startup) — with the Microsoft/Sysinternals references above for the exact commands and tools.

Member Avatar for jzuzphreek

Ok, so I ended the offending process (with great trepidation), and nothing happened. The CPU Usage went back to normal levels, and the world was happy. I restarted the computer, and BAM! the process was back! Is there a way I can terminate that extra process permanatly?

Member Avatar for jzuzphreek

Ok, after talking with a friend, I looked up the PID of the process (968) and ran netstat -ano at the command prompt. The offending process is (don't know if this terminology is correct) running(?) on UDP ports and 0.0.0.0:1073. I don't know if this helps in the troubleshooting process at all.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.